Unbinding TCP From Virtual Network Physical NIC

I’ve just realised that I’d forgotten to talk about this subject.  I remembered about it after reading Taylor Brown’s blog about unbinding TCP from the physical NIC that virtual machines are using on a Hyper-V host.

During my testing of our cluster I had to simulate a real environment.  For us, that’s lots of virtual networks that are secured using physical firewall rules.  The virtual networks are created on the physical network using VLAN’s and in Hyper-V using VLAN tagging.  We do this by tagging the virtual machine at the host level.

When I originally set up the hosts I didn’t do anything special to the local area connections in Windows networking that represent the physical NIC’s the VM’s use to communicate with the physical network.  After some testing I soon found a problem.  My host was getting DHCP addresses from one of my virtual test networks.  How in the hell did that happen?  Simple.  TCP was still bound to the physical NIC.  The NIC was on the same broadcast domain as one of the virtual networks.  That’s a serious security issue.

The solution is simple.  As you probably know, any NIC that is used for virtual networking should be dedicated purely to virtual networking.  The parent partition (host OS) should have dedicated NIC(s) for management and security purposes, e.g. different VLAN and not prone to being congested due to VM OS/application misbehaviour.  You should then unbind TCP from your NIC’s that are dedicated to virtual networking.  This in no way affects the host nor the VM’s.  And Taylor Brown also recommends unbinding any other network protocol that you happen to add to the parent partition.

Now, your host partition is completely isolated network-wise from the virtual networks that it’s guest VM’s are bound to.  This allows you to create secured VLAN’s via tagging for your VM’s, e.g. a VM can be on a network that is isolated via firewall rules from the parent partition.